Vista Giving Trouble

C

Cg123

New member
Hi there,
Running Windows Vista Home Premium.SP2.
Searched in loads of sites... none to pleasing, and figured it was time to turn to more experienced experts :P

Within the last, lets say, 20-30 days, vista has been playing up... Firstly it was returning from "Sleep Mode" and then causing a restart...that has ceased. I thought i was set on the right track.. soon to be dashed.

Vista is now on its last legs, i need some desperate help.
Symtops/errors:
1."DCOM server unresponsive- automatic restart",
2."Windows will restart in one minute" -No reason given
3. HP Health Check service has stopped working
4. Catalyst Control Centre:Command Line Interface has stopped working.
5. Windows 7 upgrade advisor has stopped working.
6. Host Process for Windows Services has Stopped working.
7. play and play service has terminated unexpectantly and windows must now restart
8.DCOM has terminated unexpectantly and windows must now restart


There are many more, but cant remember off the top of my head. Also, Norton Internet Security is always blocking an attack:
An intrusion attempt by 212.117.174.176 was blocked.Application path \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\SVCHOST.EXE
risk name:HTTPS Tidserv C and C Domain Request.

I am only assuming, and quite possibly assuming wrongly, that the two are interlinked,im oblivious to whether that is true or not.

Thanks for any help in advance, though im not expecting any right away/for a few days as Christmas. :)

Here is the HiJackThis Report:
Note: While I ran this, I had numerous GoogleChrome Tabs open, i see many chrome.exe lines in it...and thats the reason.Also I just scraped by and managed to save the report prior to one of the errors above..I believe it was the DCOM error.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:16:57, on 26/12/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18865)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Registry Mechanic\RMTray.exe
C:\Program Files\Edimax\Common\RaUI.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\mmc.exe
C:\Windows\system32\taskmgr.exe
C:\Windows\system32\Dwm.exe
C:\Users\skahana\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\skahana\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\skahana\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\skahana\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\skahana\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\skahana\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\skahana\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\mmc.exe
C:\Users\skahana\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\skahana\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\skahana\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\skahana\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\skahana\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\skahana\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\skahana\Documents\Downloads\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=\\.\globalroot\systemroot\system32\userinit.exe,
O1 - Hosts: ::1 localhost
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [SSDMonitor] C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RMTray.exe /H
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Default user')
O4 - Global Startup: Edimax Wireless Utility.lnk = C:\Program Files\Edimax\Common\RaUI.exe
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O13 - Gopher Prefix:
O15 - Trusted Zone: http://pavilion.buttonredirect.hp.com
O15 - Trusted Zone: http://presario.buttonredirect.hp.com
O16 - DPF: {6824D897-F7E1-4E41-B84B-B1D3FA4BF1BD} (PCPitstop AntiVirus) - http://utilities.pcpitstop.com/Exterminate2/pcpitstopAntiVirus.dll
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/Optimize3/pcpitstop2.dll
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: lxddCATSCustConnectService - Lexmark International, Inc. - C:\Windows\system32\spool\DRIVERS\W32X86\3\\lxddserv.exe
O23 - Service: lxdd_device - - C:\Windows\system32\lxddcoms.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
O23 - Service: PC Tools Startup and Shutdown Monitor service (PCToolsSSDMonitorSvc) - PC Tools - C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe

--
End of file - 7174 bytes

Thanks in advance
Cg123 :)
 
Hi,

Download DDS and save it to your desktop from here or here or here.
Disable any script blocker, and then double click dds.scr to run the tool.
  • When done, DDS will open two (2) logs:
    1. DDS.txt
    2. Attach.txt
  • Save both reports to your desktop. Post them back to your topic.
 
Dds file

DDS FILE


DDS (Ver_09-12-01.01) - NTFSx86
Run by skahana at 13:22:33.58 on 30/12/2009
Internet Explorer: 8.0.6001.18865 BrowserJavaVersion: 1.6.0_17
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.353.1033.18.1022.231 [GMT 0:00]

AV: Norton Internet Security *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
SP: Norton Internet Security *enabled* (Updated) {CBB7EE13-8244-4DAB-8B55-D5C7AA91E59A}
FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k bthsvcs
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Windows\system32\spool\DRIVERS\W32X86\3\lxddserv.exe
C:\Windows\system32\lxddcoms.exe
C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\svchost.exe -k netsvc
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DllHost.exe
C:\Windows\System32\alg.exe
C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Registry Mechanic\RMTray.exe
C:\Program Files\Edimax\Common\RaUI.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\jusched.exe
C:\Windows\system32\vssvc.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Users\skahana\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\skahana\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\skahana\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\skahana\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\skahana\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\skahana\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\skahana\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\skahana\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\skahana\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uInternet Settings,ProxyOverride = *.local
mWinlogon: Userinit=\\.\globalroot\systemroot\system32\userinit.exe,
TB: DAEMON Tools Toolbar: {32099aac-c132-4136-9e9a-4e364a424e17} - c:\program files\daemon tools toolbar\DTToolbar.dll
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton internet security\norton internet security\engine\16.7.2.11\coIEPlg.dll
TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No File
TB: {BC4FFE41-DE9F-46FA-B455-AAD49B9F9938} - No File
TB: {EEE6C35B-6118-11DC-9C72-001320C79847} - No File
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [RegistryMechanic] c:\program files\registry mechanic\RMTray.exe /H
mRun: [SSDMonitor] c:\program files\common files\pc tools\smonitor\SSDMonitor.exe
dRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\edimax~1.lnk - c:\program files\edimax\common\RaUI.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
Trusted Zone: hp.com\pavilion.buttonredirect
Trusted Zone: hp.com\presario.buttonredirect
Trusted Zone: vodafone.ie\mim
Trusted Zone: vodafone.ie\www
DPF: {6824D897-F7E1-4E41-B84B-B1D3FA4BF1BD} - hxxp://utilities.pcpitstop.com/Exterminate2/pcpitstopAntiVirus.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} - hxxp://utilities.pcpitstop.com/Optimize3/pcpitstop2.dll
Handler: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - c:\program files\norton internet security\norton internet security\engine\16.7.2.11\CoIEPlg.dll

================= FIREFOX ===================

FF - ProfilePath - c:\users\skahana\appdata\roaming\mozilla\firefox\profiles\cp2axbp7.default\
FF - prefs.js: browser.startup.homepage - google.ie
FF - component: c:\program files\nokia\nokia pc suite 7\bkmrksync\components\BkMrkExt.dll
FF - component: c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\coffplgn\components\coFFPlgn.dll
FF - component: c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\ipsffplgn\components\IPSFFPl.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\users\skahana\appdata\local\google\update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\users\skahana\appdata\roaming\mozilla\firefox\profiles\cp2axbp7.default\extensions\{e2883e8f-472f-4fb0-9522-ac9bf37916a7}\plugins\np_gp.dll
FF - plugin: c:\users\skahana\program files\dna\plugins\npbtdna.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: google.toolbar.linkdoctor.enabled - false

============= SERVICES / DRIVERS ===============


=============== Created Last 30 ================

2009-12-24 03:39:55 0 d-----w- c:\users\skahana\appdata\roaming\Registry Mechanic
2009-12-24 03:21:47 880640 ----a-w- c:\windows\system32\UniBox10.ocx
2009-12-24 03:21:47 506368 ----a-w- c:\windows\system32\msxml.dll
2009-12-24 03:21:47 212992 ----a-w- c:\windows\system32\UniBoxVB12.ocx
2009-12-24 03:21:47 1101824 ----a-w- c:\windows\system32\UniBox210.ocx
2009-12-24 03:21:42 0 d-----w- c:\program files\common files\PC Tools
2009-12-24 02:55:01 1576 ----a-w- c:\windows\system32\.htaccess
2009-12-24 00:47:21 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-24 00:47:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-24 00:47:12 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-12-24 00:01:18 0 d-----w- C:\SDFix
2009-12-23 23:02:54 691 ----a-w- c:\users\skahana\appdata\roaming\GetValue.vbs
2009-12-23 23:02:54 35 ----a-w- c:\users\skahana\appdata\roaming\SetValue.bat
2009-12-23 23:02:53 1092 ----a-w- c:\windows\system32\tmp.reg
2009-12-23 20:22:04 0 d-----w- c:\programdata\PCPitstop
2009-12-23 20:22:02 0 d-----w- c:\program files\PCPitstop
2009-12-12 03:01:14 24064 ----a-w- c:\windows\system32\nshhttp.dll
2009-12-12 03:01:08 411648 ----a-w- c:\windows\system32\drivers\http.sys
2009-12-12 03:01:07 30720 ----a-w- c:\windows\system32\httpapi.dll
2009-12-09 23:12:08 377344 ----a-w- c:\windows\system32\winhttp.dll
2009-12-09 23:08:31 243712 ----a-w- c:\windows\system32\rastls.dll
2009-12-09 00:24:37 0 d-----w- c:\programdata\NOS
2009-12-08 22:57:44 0 d-----w- c:\program files\Microsoft Windows 7 Upgrade Advisor
2009-12-08 20:46:52 0 d-----w- c:\programdata\Malwarebytes
2009-12-08 20:29:18 0 d-----w- c:\users\skahana\appdata\roaming\WinBatch
2009-12-08 20:15:44 0 d-----w- c:\program files\Garmin GPS Plugin

==================== Find3M ====================

2009-12-17 12:31:23 5636 ----a-w- c:\users\skahana\appdata\roaming\wklnhst.dat
2009-12-08 20:15:39 51200 ----a-w- c:\windows\inf\infpub.dat
2009-12-08 20:15:39 143360 ----a-w- c:\windows\inf\infstrng.dat
2009-12-08 20:15:39 143360 ----a-w- c:\windows\inf\infstor.dat
2009-11-21 06:40:20 916480 ----a-w- c:\windows\system32\wininet.dll
2009-11-21 06:34:39 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-11-21 06:34:39 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-11-21 04:59:58 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-11-18 03:24:48 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-11-18 03:24:39 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2009-11-18 03:23:58 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
2009-11-02 20:42:06 195456 ------w- c:\windows\system32\MpSigStub.exe
2009-10-31 19:53:54 37665 ----a-w- c:\windows\fonts\GlobalUserInterface.CompositeFont
2009-10-29 09:17:42 2048 ----a-w- c:\windows\system32\tzres.dll
2009-10-11 04:17:27 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-10-08 21:08:01 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll
2009-10-08 21:08:01 234496 ----a-w- c:\windows\system32\oleacc.dll
2009-10-08 21:07:59 4096 ----a-w- c:\windows\system32\oleaccrc.dll
2008-12-08 03:51:22 174 --sha-w- c:\program files\desktop.ini
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
2007-09-14 02:50:13 8192 --sha-w- c:\windows\users\default\NTUSER.DAT

============= FINISH: 13:29:44.16 ===============
 
Attach file

ATTACH FILE

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-12-01.01)

Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 24/09/2007 19:06:26
System Uptime: 28/12/2009 10:51:48 (51 hours ago)

Motherboard: ECS | | Nettle2
Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 4000+ | Socket M2 | 1000/201mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 225 GiB total, 44.092 GiB free.
D: is FIXED (NTFS) - 7 GiB total, 1.021 GiB free.
E: is CDROM ()
F: is Removable
G: is Removable
H: is Removable
I: is Removable
J: is CDROM ()
K: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {4d36e97d-e325-11ce-bfc1-08002be10318}
Description: Plug and Play Software Device Enumerator
Device ID: ROOT\SYSTEM\0000
Manufacturer: (Standard system devices)
Name: Plug and Play Software Device Enumerator
PNP Device ID: ROOT\SYSTEM\0000
Service: swenum

Class GUID: {eec5ad98-8080-425f-922a-dabf3de3f69a}
Description: USB CF Reader
Device ID: WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_GENERIC&PROD_USB_CF_READER&REV_1.01#920321111113&1#
Manufacturer: Generic
Name: USB CF Reader
PNP Device ID: WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_GENERIC&PROD_USB_CF_READER&REV_1.01#920321111113&1#
Service: WUDFRd

Class GUID: {eec5ad98-8080-425f-922a-dabf3de3f69a}
Description: USB MS Reader
Device ID: WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_GENERIC&PROD_USB_MS_READER&REV_1.03#920321111113&3#
Manufacturer: Generic
Name: USB MS Reader
PNP Device ID: WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_GENERIC&PROD_USB_MS_READER&REV_1.03#920321111113&3#
Service: WUDFRd

Class GUID: {eec5ad98-8080-425f-922a-dabf3de3f69a}
Description: USB SD Reader
Device ID: WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_GENERIC&PROD_USB_SD_READER&REV_1.00#920321111113&0#
Manufacturer: Generic
Name: USB SD Reader
PNP Device ID: WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_GENERIC&PROD_USB_SD_READER&REV_1.00#920321111113&0#
Service: WUDFRd

Class GUID: {eec5ad98-8080-425f-922a-dabf3de3f69a}
Description: USB SM Reader
Device ID: WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_GENERIC&PROD_USB_SM_READER&REV_1.02#920321111113&2#
Manufacturer: Generic
Name: USB SM Reader
PNP Device ID: WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_GENERIC&PROD_USB_SM_READER&REV_1.02#920321111113&2#
Service: WUDFRd

==== System Restore Points ===================

No restore point in system.

==== Installed Programs ======================

ABBYY FineReader 6.0 Sprint
AC3Filter (remove only)
ActiveCheck component for HP Active Support Library
Adobe AIR
Adobe Flash Player 10 Plugin
Adobe Media Player
Adobe Reader 8.1.7
Adobe Shockwave Player 11.5
Age of Empires III
Age of Mythology
Age of Mythology - The Titans Expansion
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ATI Catalyst Install Manager
AutoUpdate
BitTorrent
Bonjour
Catalyst Control Center Core Implementation
Catalyst Control Center Graphics Full Existing
Catalyst Control Center Graphics Full New
Catalyst Control Center Graphics Light
Catalyst Control Center Graphics Previews Common
Catalyst Control Center Graphics Previews Vista
Catalyst Control Center Localization Chinese Standard
Catalyst Control Center Localization Chinese Traditional
Catalyst Control Center Localization Czech
Catalyst Control Center Localization Danish
Catalyst Control Center Localization Dutch
Catalyst Control Center Localization Finnish
Catalyst Control Center Localization French
Catalyst Control Center Localization German
Catalyst Control Center Localization Greek
Catalyst Control Center Localization Hungarian
Catalyst Control Center Localization Italian
Catalyst Control Center Localization Japanese
Catalyst Control Center Localization Korean
Catalyst Control Center Localization Norwegian
Catalyst Control Center Localization Polish
Catalyst Control Center Localization Portuguese
Catalyst Control Center Localization Russian
Catalyst Control Center Localization Spanish
Catalyst Control Center Localization Swedish
Catalyst Control Center Localization Thai
Catalyst Control Center Localization Turkish
ccc-Branding
ccc-core-static
ccc-utility
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help Czech
CCC Help Danish
CCC Help Dutch
CCC Help English
CCC Help Finnish
CCC Help French
CCC Help German
CCC Help Greek
CCC Help Hungarian
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Norwegian
CCC Help Polish
CCC Help Portuguese
CCC Help Russian
CCC Help Spanish
CCC Help Swedish
CCC Help Thai
CCC Help Turkish
CheckIt Diagnostics
Command & Conquer
DAEMON Tools Toolbar
DivX Codec
DivX Converter
DivX Player
DivX Web Player
DNA
Edimax Wireless LAN Card
Enhanced Multimedia Keyboard Solution
ESET Online Scanner v3
Express Burn
FrostWire 4.18.1
Garmin City Navigator Europe NT 2010 Update
Garmin Communicator Plugin
Garmin USB Drivers
Google Chrome
Google Earth
Google Toolbar for Internet Explorer
Ground Control Demo
Hardware Diagnostic Tools
HijackThis 2.0.2
Homeworld
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Active Support Library
HP Active Support Library 32 bit components
HP Advisor
HP Customer Experience Enhancements
HP Customer Feedback
HP Easy Setup - Frontend
HP On-Screen Cap/Num/Scroll Lock Indicator
HP Photosmart Essential 2.01
HP Photosmart Essential2.01
HP Picasso Media Center Add-In
HP Update
HPAsset component for HP Active Support Library
Inpaint
iTunes
Java(TM) 6 Update 17
Java(TM) SE Runtime Environment 6 Update 1
Junk Mail filter update
Lexmark 2500 Series
Lexmark Fax Solutions
LightScribe 1.8.15.1
LiveUpdate 3.2 (Symantec Corporation)
LiveUpdate Notice (Symantec Corporation)
Malwarebytes' Anti-Malware
Max Invaders
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Office Excel Viewer 2003
Microsoft Office Home and Student 60 day trial
Microsoft Office Word Viewer 2003
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Works
MobileMe Control Panel
Mozilla Firefox (3.0.15)
MSVC80_x86
MSVCRT
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML4 Parser
muvee autoProducer 6.0
MySQL Connector/ODBC 3.51
Nero Digital CE
neroxml
Nokia Connectivity Cable Driver
Nokia PC Suite
Norton Internet Security
PC Connectivity Solution
PE Builder 3.1.10a
Pixillion
Populous: Undiscovered Worlds - Patch
Prism Video Converter
PSSWCORE
Python 2.5
QuickTime
Realtek High Definition Audio Driver
Registry Mechanic 9.0
Roxio Activation Module
Roxio Creator Audio
Roxio Creator Basic v9
Roxio Creator Copy
Roxio Creator Data
Roxio Creator EasyArchive
Roxio Creator Tools
Roxio Express Labeler 3
Roxio MyDVD Basic v9
Sierra Utilities
Skins
Sony Picture Utility
SopCast 3.2.4
Switch Sound File Converter
The Battle for Middle-earth (tm)
The Battle for Middle-earth (tm) II
The Sims 2
The Sims 2 Open For Business
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
VideoToolkit01
Viewpoint Media Player
Windows 7 Upgrade Advisor
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)
Windows Driver Package - Nokia Modem (06/01/2009 4.1)
Windows Driver Package - Nokia Modem (06/01/2009 7.01.0.3)
Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0)
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Family Safety
Windows Live Mail
Windows Live Messenger
Windows Live Movie Maker
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Toolbar
Windows Live Upload Tool
Windows Live Writer
WinRAR archiver

==== Event Viewer Messages From Past Week ========

29/12/2009 23:44:56, Error: bowser [8003] - The master browser has received a server announcement from the computer CIARANLAPTOP that believes that it is the master browser for the domain on transport NetBT_Tcpip_{CFD920E1-F015-4DC7-813D-E77AF. The master browser is stopping or an election is being forced.
29/12/2009 13:36:03, Error: netr28u [5001] - 802.11n USB Wireless LAN Card #6 : Could not allocate the resources necessary for operation.
29/12/2009 13:26:36, Error: Microsoft-Windows-SharedAccess_NAT [31004] - The DNS proxy agent was unable to allocate 0 bytes of memory. This may indicate that the system is low on virtual memory, or that the memory manager has encountered an internal error.
28/12/2009 10:56:19, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the HP Health Check Service service to connect.
28/12/2009 10:56:19, Error: Service Control Manager [7000] - The HP Health Check Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
28/12/2009 10:48:59, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Reboot the machine) after the unexpected termination of the Plug and Play service, but this action failed with the following error: A system shutdown has already been scheduled.
28/12/2009 10:48:58, Error: Service Control Manager [7031] - The Plug and Play service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Reboot the machine.
28/12/2009 10:48:58, Error: Service Control Manager [7031] - The DCOM Server Process Launcher service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Reboot the machine.
27/12/2009 20:33:50, Error: EventLog [6008] - The previous system shutdown at 20:32:04 on 27/12/2009 was unexpected.
27/12/2009 06:17:31, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Reboot the machine) after the unexpected termination of the DCOM Server Process Launcher service, but this action failed with the following error: A system shutdown has already been scheduled.
26/12/2009 21:09:19, Error: Microsoft-Windows-PrintSpooler [6161] - The document Untitled - Notepad, owned by skahana, failed to print on printer Lexmark 2500 Series. Try to print the document again, or restart the print spooler. Data type: LEMF. Size of the spool file in bytes: 45716. Number of bytes printed: 45716. Total number of pages in the document: 1. Number of pages printed: 0. Client computer: \\SKAHANA-PC. Win32 error code returned by the print processor: 0. The operation completed successfully.
26/12/2009 21:03:57, Error: EventLog [6008] - The previous system shutdown at 20:58:27 on 26/12/2009 was unexpected.
26/12/2009 19:59:58, Error: EventLog [6008] - The previous system shutdown at 19:57:40 on 26/12/2009 was unexpected.
26/12/2009 13:52:30, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the TrkWks service.
26/12/2009 02:42:04, Error: EventLog [6008] - The previous system shutdown at 02:39:56 on 26/12/2009 was unexpected.
26/12/2009 02:38:24, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the LanmanServer service.
26/12/2009 01:46:48, Error: Service Control Manager [7034] - The SeaPort service terminated unexpectedly. It has done this 1 time(s).
26/12/2009 01:46:25, Error: Service Control Manager [7034] - The PC Tools Startup and Shutdown Monitor service service terminated unexpectedly. It has done this 1 time(s).
26/12/2009 01:45:35, Error: Service Control Manager [7034] - The Diagnostic System Host service terminated unexpectedly. It has done this 1 time(s).
26/12/2009 01:45:35, Error: Service Control Manager [7031] - The WLAN AutoConfig service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
26/12/2009 01:45:35, Error: Service Control Manager [7031] - The Windows Driver Foundation - User-mode Driver Framework service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
26/12/2009 01:45:35, Error: Service Control Manager [7031] - The Windows Audio Endpoint Builder service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
26/12/2009 01:45:35, Error: Service Control Manager [7031] - The Tablet PC Input Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
26/12/2009 01:45:35, Error: Service Control Manager [7031] - The Superfetch service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
26/12/2009 01:45:35, Error: Service Control Manager [7031] - The ReadyBoost service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
26/12/2009 01:45:35, Error: Service Control Manager [7031] - The Program Compatibility Assistant Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
26/12/2009 01:45:35, Error: Service Control Manager [7031] - The Portable Device Enumerator Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
26/12/2009 01:45:35, Error: Service Control Manager [7031] - The Network Connections service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 100 milliseconds: Restart the service.
26/12/2009 01:45:35, Error: Service Control Manager [7031] - The Distributed Link Tracking Client service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
26/12/2009 01:45:35, Error: Service Control Manager [7031] - The Desktop Window Manager Session Manager service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

==== End Of File ===========================
 
Hi,

IMPORTANT I notice there are signs of one or more P2P (Peer to Peer) File Sharing Programs on your computer.

BitTorrent
DNA


I'd like you to read this thread.

Please go to Control Panel > Programs and Features and uninstall the programs listed above (in red).


After that:


Please visit this webpage for download links, and instructions for running ComboFix tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please ensure you read this guide carefully first.


Please continue as follows:

  1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link
    Remember to re-enable them afterwards.

  2. Click Yes to allow ComboFix to continue scanning for malware.

When the tool is finished, it will produce a report for you.

Please include the following reports for further review, and so we may continue cleansing the system:

C:\ComboFix.txt
New dds log.

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.
 
What are p2p file sharing programs???
:/ must have been installed by my lil kid! well teenager

I will put the logs up later, when that scan finishes... How long approx will it take? or does it vary from pc to pc?

thanks
cg123
 
Hi,

P2P filesharing programs is explained in that link posted in my previous post.

The scan shouldn't take too long. It does depend on system but shouldn't normally take over an hour.
 
New DDS Log

New DDS Log

DDS (Ver_09-12-01.01) - NTFSx86
Run by skahana at 19:17:06.72 on 30/12/2009
Internet Explorer: 8.0.6001.18865 BrowserJavaVersion: 1.6.0_17
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.353.1033.18.1022.369 [GMT 0:00]

AV: Norton Internet Security *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
SP: Norton Internet Security *enabled* (Updated) {CBB7EE13-8244-4DAB-8B55-D5C7AA91E59A}
FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k bthsvcs
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Windows\system32\spool\DRIVERS\W32X86\3\lxddserv.exe
C:\Windows\system32\lxddcoms.exe
C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\alg.exe
C:\Windows\system32\DllHost.exe
C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Registry Mechanic\RMTray.exe
C:\Program Files\Edimax\Common\RaUI.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\skahana\Desktop\dds.scr
C:\Program Files\Windows Sidebar\sidebar.exe

============== Pseudo HJT Report ===============

uInternet Settings,ProxyOverride = *.local
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton internet security\norton internet security\engine\16.7.2.11\coIEPlg.dll
TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No File
TB: {BC4FFE41-DE9F-46FA-B455-AAD49B9F9938} - No File
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [RegistryMechanic] c:\program files\registry mechanic\RMTray.exe /H
mRun: [SSDMonitor] c:\program files\common files\pc tools\smonitor\SSDMonitor.exe
dRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\edimax~1.lnk - c:\program files\edimax\common\RaUI.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
Trusted Zone: hp.com\pavilion.buttonredirect
Trusted Zone: hp.com\presario.buttonredirect
Trusted Zone: vodafone.ie\mim
Trusted Zone: vodafone.ie\www
DPF: {6824D897-F7E1-4E41-B84B-B1D3FA4BF1BD} - hxxp://utilities.pcpitstop.com/Exterminate2/pcpitstopAntiVirus.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} - hxxp://utilities.pcpitstop.com/Optimize3/pcpitstop2.dll
Handler: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - c:\program files\norton internet security\norton internet security\engine\16.7.2.11\CoIEPlg.dll

================= FIREFOX ===================

FF - ProfilePath - c:\users\skahana\appdata\roaming\mozilla\firefox\profiles\cp2axbp7.default\
FF - prefs.js: browser.startup.homepage - google.ie
FF - component: c:\program files\nokia\nokia pc suite 7\bkmrksync\components\BkMrkExt.dll
FF - component: c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\coffplgn\components\coFFPlgn.dll
FF - component: c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\ipsffplgn\components\IPSFFPl.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\users\skahana\appdata\local\google\update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\users\skahana\appdata\roaming\mozilla\firefox\profiles\cp2axbp7.default\extensions\{e2883e8f-472f-4fb0-9522-ac9bf37916a7}\plugins\np_gp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\nis\1007020.00b\SymEFA.sys [2009-8-31 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\nis\1007020.00b\BHDrvx86.sys [2009-8-31 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\nis\1007020.00b\cchpx86.sys [2009-8-31 482432]
R1 IDSVix86;IDSVix86;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\ipsdefs\20091217.002\IDSvix86.sys [2009-12-18 343088]
R2 lxdd_device;lxdd_device;c:\windows\system32\lxddcoms.exe -service --> c:\windows\system32\lxddcoms.exe -service [?]
R2 lxddCATSCustConnectService;lxddCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxddserv.exe [2007-5-25 99248]
R2 Norton Internet Security;Norton Internet Security;c:\program files\norton internet security\norton internet security\engine\16.7.2.11\ccSvcHst.exe [2009-8-31 117640]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\common files\pc tools\smonitor\StartManSvc.exe [2009-12-24 583640]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-12-8 102448]
R3 SYMNDISV;Symantec Network Filter Driver;c:\windows\system32\drivers\nis\1007020.00b\symndisv.sys [2009-8-31 48688]
S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-6-30 21504]
S3 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2009-10-27 54632]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2009-8-5 704864]
S3 netr28u;802.11n USB Wireless LAN Card Driver for Vista;c:\windows\system32\drivers\netr28u.sys [2008-1-28 328192]
S3 s115bus;Sony Ericsson Device 115 driver (WDM);c:\windows\system32\drivers\s115bus.sys [2007-4-23 83208]
S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;c:\windows\system32\drivers\s115mdfl.sys [2007-4-23 15112]
S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;c:\windows\system32\drivers\s115mdm.sys [2007-4-23 108680]
S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s115mgmt.sys [2007-4-23 100488]
S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;c:\windows\system32\drivers\s115obex.sys [2007-4-23 98568]

=============== Created Last 30 ================

2009-12-30 18:41:06 0 d-sh--w- C:\$RECYCLE.BIN
2009-12-30 18:10:03 98816 ----a-w- c:\windows\sed.exe
2009-12-30 18:10:03 77312 ----a-w- c:\windows\MBR.exe
2009-12-30 18:10:03 261632 ----a-w- c:\windows\PEV.exe
2009-12-30 18:10:03 161792 ----a-w- c:\windows\SWREG.exe
2009-12-24 03:39:55 0 d-----w- c:\users\skahana\appdata\roaming\Registry Mechanic
2009-12-24 03:21:47 880640 ----a-w- c:\windows\system32\UniBox10.ocx
2009-12-24 03:21:47 506368 ----a-w- c:\windows\system32\msxml.dll
2009-12-24 03:21:47 212992 ----a-w- c:\windows\system32\UniBoxVB12.ocx
2009-12-24 03:21:47 1101824 ----a-w- c:\windows\system32\UniBox210.ocx
2009-12-24 03:21:42 0 d-----w- c:\program files\common files\PC Tools
2009-12-24 02:55:01 1576 ----a-w- c:\windows\system32\.htaccess
2009-12-24 00:47:21 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-24 00:47:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-24 00:47:12 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-12-24 00:01:18 0 d-----w- C:\SDFix
2009-12-23 23:02:54 691 ----a-w- c:\users\skahana\appdata\roaming\GetValue.vbs
2009-12-23 23:02:54 35 ----a-w- c:\users\skahana\appdata\roaming\SetValue.bat
2009-12-23 20:22:04 0 d-----w- c:\programdata\PCPitstop
2009-12-23 20:22:02 0 d-----w- c:\program files\PCPitstop
2009-12-12 03:01:14 24064 ----a-w- c:\windows\system32\nshhttp.dll
2009-12-12 03:01:08 411648 ----a-w- c:\windows\system32\drivers\http.sys
2009-12-12 03:01:07 30720 ----a-w- c:\windows\system32\httpapi.dll
2009-12-09 23:12:08 377344 ----a-w- c:\windows\system32\winhttp.dll
2009-12-09 23:08:31 243712 ----a-w- c:\windows\system32\rastls.dll
2009-12-09 00:24:37 0 d-----w- c:\programdata\NOS
2009-12-08 22:57:44 0 d-----w- c:\program files\Microsoft Windows 7 Upgrade Advisor
2009-12-08 20:46:52 0 d-----w- c:\programdata\Malwarebytes
2009-12-08 20:29:18 0 d-----w- c:\users\skahana\appdata\roaming\WinBatch
2009-12-08 20:15:44 0 d-----w- c:\program files\Garmin GPS Plugin

==================== Find3M ====================

2009-12-17 12:31:23 5636 ----a-w- c:\users\skahana\appdata\roaming\wklnhst.dat
2009-12-08 20:15:39 51200 ----a-w- c:\windows\inf\infpub.dat
2009-12-08 20:15:39 143360 ----a-w- c:\windows\inf\infstrng.dat
2009-12-08 20:15:39 143360 ----a-w- c:\windows\inf\infstor.dat
2009-11-21 06:40:20 916480 ----a-w- c:\windows\system32\wininet.dll
2009-11-21 06:34:39 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-11-21 06:34:39 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-11-21 04:59:58 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-11-18 03:24:48 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-11-18 03:24:39 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2009-11-18 03:23:58 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
2009-11-02 20:42:06 195456 ------w- c:\windows\system32\MpSigStub.exe
2009-10-31 19:53:54 37665 ----a-w- c:\windows\fonts\GlobalUserInterface.CompositeFont
2009-10-29 09:17:42 2048 ----a-w- c:\windows\system32\tzres.dll
2009-10-11 04:17:27 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-10-08 21:08:01 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll
2009-10-08 21:08:01 234496 ----a-w- c:\windows\system32\oleacc.dll
2009-10-08 21:07:59 4096 ----a-w- c:\windows\system32\oleaccrc.dll
2008-12-08 03:51:22 174 --sha-w- c:\program files\desktop.ini
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
2007-09-14 02:50:13 8192 --sha-w- c:\windows\users\default\NTUSER.DAT

============= FINISH: 19:20:33.78 ===============
 
New Attach File


UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-12-01.01)

Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 24/09/2007 19:06:26
System Uptime: 30/12/2009 19:14:32 (0 hours ago)

Motherboard: ECS | | Nettle2
Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 4000+ | Socket M2 | 2100/201mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 225 GiB total, 45.537 GiB free.
D: is FIXED (NTFS) - 7 GiB total, 1.021 GiB free.
E: is CDROM ()
F: is Removable
G: is Removable
H: is Removable
I: is Removable

==== Disabled Device Manager Items =============

==== System Restore Points ===================

No restore point in system.

==== Installed Programs ======================

ABBYY FineReader 6.0 Sprint
AC3Filter (remove only)
ActiveCheck component for HP Active Support Library
Adobe AIR
Adobe Flash Player 10 Plugin
Adobe Media Player
Adobe Reader 8.1.7
Adobe Shockwave Player 11.5
Age of Empires III
Age of Mythology
Age of Mythology - The Titans Expansion
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ATI Catalyst Install Manager
AutoUpdate
Bonjour
Catalyst Control Center Core Implementation
Catalyst Control Center Graphics Full Existing
Catalyst Control Center Graphics Full New
Catalyst Control Center Graphics Light
Catalyst Control Center Graphics Previews Common
Catalyst Control Center Graphics Previews Vista
Catalyst Control Center Localization Chinese Standard
Catalyst Control Center Localization Chinese Traditional
Catalyst Control Center Localization Czech
Catalyst Control Center Localization Danish
Catalyst Control Center Localization Dutch
Catalyst Control Center Localization Finnish
Catalyst Control Center Localization French
Catalyst Control Center Localization German
Catalyst Control Center Localization Greek
Catalyst Control Center Localization Hungarian
Catalyst Control Center Localization Italian
Catalyst Control Center Localization Japanese
Catalyst Control Center Localization Korean
Catalyst Control Center Localization Norwegian
Catalyst Control Center Localization Polish
Catalyst Control Center Localization Portuguese
Catalyst Control Center Localization Russian
Catalyst Control Center Localization Spanish
Catalyst Control Center Localization Swedish
Catalyst Control Center Localization Thai
Catalyst Control Center Localization Turkish
ccc-Branding
ccc-core-static
ccc-utility
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help Czech
CCC Help Danish
CCC Help Dutch
CCC Help English
CCC Help Finnish
CCC Help French
CCC Help German
CCC Help Greek
CCC Help Hungarian
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Norwegian
CCC Help Polish
CCC Help Portuguese
CCC Help Russian
CCC Help Spanish
CCC Help Swedish
CCC Help Thai
CCC Help Turkish
CheckIt Diagnostics
Command & Conquer
DivX Codec
DivX Converter
DivX Player
DivX Web Player
Edimax Wireless LAN Card
Enhanced Multimedia Keyboard Solution
ESET Online Scanner v3
Express Burn
FrostWire 4.18.1
Garmin City Navigator Europe NT 2010 Update
Garmin Communicator Plugin
Garmin USB Drivers
Google Chrome
Google Earth
Google Toolbar for Internet Explorer
Ground Control Demo
Hardware Diagnostic Tools
HijackThis 2.0.2
Homeworld
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Active Support Library
HP Active Support Library 32 bit components
HP Advisor
HP Customer Experience Enhancements
HP Customer Feedback
HP Easy Setup - Frontend
HP On-Screen Cap/Num/Scroll Lock Indicator
HP Photosmart Essential 2.01
HP Photosmart Essential2.01
HP Picasso Media Center Add-In
HP Update
HPAsset component for HP Active Support Library
Inpaint
iTunes
Java(TM) 6 Update 17
Java(TM) SE Runtime Environment 6 Update 1
Junk Mail filter update
Lexmark 2500 Series
Lexmark Fax Solutions
LightScribe 1.8.15.1
LiveUpdate 3.2 (Symantec Corporation)
LiveUpdate Notice (Symantec Corporation)
Malwarebytes' Anti-Malware
Max Invaders
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Office Excel Viewer 2003
Microsoft Office Home and Student 60 day trial
Microsoft Office Word Viewer 2003
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Works
MobileMe Control Panel
Mozilla Firefox (3.0.15)
MSVC80_x86
MSVCRT
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML4 Parser
muvee autoProducer 6.0
MySQL Connector/ODBC 3.51
Nero Digital CE
neroxml
Nokia Connectivity Cable Driver
Nokia PC Suite
Norton Internet Security
PC Connectivity Solution
PE Builder 3.1.10a
Pixillion
Populous: Undiscovered Worlds - Patch
Prism Video Converter
PSSWCORE
Python 2.5
QuickTime
Realtek High Definition Audio Driver
Registry Mechanic 9.0
Roxio Activation Module
Roxio Creator Audio
Roxio Creator Basic v9
Roxio Creator Copy
Roxio Creator Data
Roxio Creator EasyArchive
Roxio Creator Tools
Roxio Express Labeler 3
Roxio MyDVD Basic v9
Sierra Utilities
Skins
Sony Picture Utility
SopCast 3.2.4
Switch Sound File Converter
The Battle for Middle-earth (tm)
The Battle for Middle-earth (tm) II
The Sims 2
The Sims 2 Open For Business
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
VideoToolkit01
Viewpoint Media Player
Windows 7 Upgrade Advisor
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)
Windows Driver Package - Nokia Modem (06/01/2009 4.1)
Windows Driver Package - Nokia Modem (06/01/2009 7.01.0.3)
Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0)
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Family Safety
Windows Live Mail
Windows Live Messenger
Windows Live Movie Maker
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Toolbar
Windows Live Upload Tool
Windows Live Writer
WinRAR archiver

==== Event Viewer Messages From Past Week ========

30/12/2009 19:19:49, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.
30/12/2009 19:14:56, Error: EventLog [6008] - The previous system shutdown at 19:13:08 on 30/12/2009 was unexpected.
30/12/2009 18:38:27, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
30/12/2009 18:11:22, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the HP Health Check Service service to connect.
30/12/2009 18:11:22, Error: Service Control Manager [7000] - The HP Health Check Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
29/12/2009 23:44:56, Error: bowser [8003] - The master browser has received a server announcement from the computer CIARANLAPTOP that believes that it is the master browser for the domain on transport NetBT_Tcpip_{CFD920E1-F015-4DC7-813D-E77AF. The master browser is stopping or an election is being forced.
29/12/2009 13:36:03, Error: netr28u [5001] - 802.11n USB Wireless LAN Card #6 : Could not allocate the resources necessary for operation.
29/12/2009 13:26:36, Error: Microsoft-Windows-SharedAccess_NAT [31004] - The DNS proxy agent was unable to allocate 0 bytes of memory. This may indicate that the system is low on virtual memory, or that the memory manager has encountered an internal error.
28/12/2009 10:48:59, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Reboot the machine) after the unexpected termination of the Plug and Play service, but this action failed with the following error: A system shutdown has already been scheduled.
28/12/2009 10:48:58, Error: Service Control Manager [7031] - The Plug and Play service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Reboot the machine.
28/12/2009 10:48:58, Error: Service Control Manager [7031] - The DCOM Server Process Launcher service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Reboot the machine.
27/12/2009 20:33:50, Error: EventLog [6008] - The previous system shutdown at 20:32:04 on 27/12/2009 was unexpected.
27/12/2009 06:17:31, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Reboot the machine) after the unexpected termination of the DCOM Server Process Launcher service, but this action failed with the following error: A system shutdown has already been scheduled.
26/12/2009 21:09:19, Error: Microsoft-Windows-PrintSpooler [6161] - The document Untitled - Notepad, owned by skahana, failed to print on printer Lexmark 2500 Series. Try to print the document again, or restart the print spooler. Data type: LEMF. Size of the spool file in bytes: 45716. Number of bytes printed: 45716. Total number of pages in the document: 1. Number of pages printed: 0. Client computer: \\SKAHANA-PC. Win32 error code returned by the print processor: 0. The operation completed successfully.
26/12/2009 21:03:57, Error: EventLog [6008] - The previous system shutdown at 20:58:27 on 26/12/2009 was unexpected.
26/12/2009 19:59:58, Error: EventLog [6008] - The previous system shutdown at 19:57:40 on 26/12/2009 was unexpected.
26/12/2009 13:52:30, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the TrkWks service.
26/12/2009 02:42:04, Error: EventLog [6008] - The previous system shutdown at 02:39:56 on 26/12/2009 was unexpected.
26/12/2009 02:38:24, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the LanmanServer service.
26/12/2009 01:46:48, Error: Service Control Manager [7034] - The SeaPort service terminated unexpectedly. It has done this 1 time(s).
26/12/2009 01:46:25, Error: Service Control Manager [7034] - The PC Tools Startup and Shutdown Monitor service service terminated unexpectedly. It has done this 1 time(s).
26/12/2009 01:45:35, Error: Service Control Manager [7034] - The Diagnostic System Host service terminated unexpectedly. It has done this 1 time(s).
26/12/2009 01:45:35, Error: Service Control Manager [7031] - The WLAN AutoConfig service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
26/12/2009 01:45:35, Error: Service Control Manager [7031] - The Windows Driver Foundation - User-mode Driver Framework service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
26/12/2009 01:45:35, Error: Service Control Manager [7031] - The Windows Audio Endpoint Builder service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
26/12/2009 01:45:35, Error: Service Control Manager [7031] - The Tablet PC Input Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
26/12/2009 01:45:35, Error: Service Control Manager [7031] - The Superfetch service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
26/12/2009 01:45:35, Error: Service Control Manager [7031] - The ReadyBoost service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
26/12/2009 01:45:35, Error: Service Control Manager [7031] - The Program Compatibility Assistant Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
26/12/2009 01:45:35, Error: Service Control Manager [7031] - The Portable Device Enumerator Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
26/12/2009 01:45:35, Error: Service Control Manager [7031] - The Network Connections service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 100 milliseconds: Restart the service.
26/12/2009 01:45:35, Error: Service Control Manager [7031] - The Distributed Link Tracking Client service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
26/12/2009 01:45:35, Error: Service Control Manager [7031] - The Desktop Window Manager Session Manager service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
26/12/2009 00:47:06, Error: EventLog [6008] - The previous system shutdown at 00:44:58 on 26/12/2009 was unexpected.
26/12/2009 00:24:03, Error: Service Control Manager [7022] - The Windows Update service hung on starting.
25/12/2009 08:55:56, Error: EventLog [6008] - The previous system shutdown at 08:52:55 on 25/12/2009 was unexpected.
25/12/2009 02:38:32, Error: volmgr [45] - The system could not sucessfully load the crash dump driver.
24/12/2009 18:22:08, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
24/12/2009 18:22:08, Error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error 2147749155 (0x80040D23).
24/12/2009 14:31:35, Error: EventLog [6008] - The previous system shutdown at 14:29:46 on 24/12/2009 was unexpected.
24/12/2009 02:48:20, Error: Service Control Manager [7023] - The LiveUpdate service terminated with the following error: The class is configured to run as a security id different from the caller
24/12/2009 01:37:58, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
24/12/2009 01:37:20, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD BHDrvx86 ccHP DfsC eeCtrl IDSVix86 NetBIOS netbt nsiproxy PSched RasAcd rdbss Smb spldr SRTSP SRTSPX SymIM SYMTDI tdx Wanarpv6
24/12/2009 01:37:20, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
24/12/2009 01:37:20, Error: Service Control Manager [7001] - The WebDav Client Redirector Driver service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
24/12/2009 01:37:20, Error: Service Control Manager [7001] - The WebClient service depends on the WebDav Client Redirector Driver service which failed to start because of the following error: The dependency service or group failed to start.
24/12/2009 01:37:20, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
24/12/2009 01:37:20, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
24/12/2009 01:37:20, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
24/12/2009 01:37:20, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
24/12/2009 01:37:20, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service service which failed to start because of the following error: A device attached to the system is not functioning.
24/12/2009 01:37:20, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
24/12/2009 01:37:20, Error: Service Control Manager [7001] - The Network Connections service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
24/12/2009 01:37:20, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
24/12/2009 01:37:20, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
24/12/2009 01:37:20, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
24/12/2009 01:37:20, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
24/12/2009 01:37:15, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
24/12/2009 01:37:15, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
24/12/2009 01:36:41, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
24/12/2009 01:36:41, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
24/12/2009 01:36:41, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}
24/12/2009 01:36:37, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
24/12/2009 01:36:28, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
24/12/2009 00:41:08, Error: Service Control Manager [7023] - The Windows Update service terminated with the following error: The class is configured to run as a security id different from the caller
24/12/2009 00:40:49, Error: Microsoft-Windows-TBS [16392] - An error occurred while starting the TBS. The error code was 0x8007000d.
24/12/2009 00:27:37, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
23/12/2009 23:59:03, Error: EventLog [6008] - The previous system shutdown at 23:57:26 on 23/12/2009 was unexpected.
23/12/2009 23:56:03, Error: netbt [4321] - The name "ABC :1d" could not be registered on the interface with IP address 192.168.1.1. The computer with the IP address 192.168.1.2 did not allow the name to be claimed by this computer.
23/12/2009 23:13:41, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Media Player Network Sharing Service service to connect.
23/12/2009 23:13:41, Error: Service Control Manager [7000] - The Windows Media Player Network Sharing Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
23/12/2009 21:35:46, Error: EventLog [6008] - The previous system shutdown at 20:42:56 on 23/12/2009 was unexpected.
23/12/2009 20:40:32, Error: EventLog [6008] - The previous system shutdown at 20:34:36 on 23/12/2009 was unexpected.

==== End Of File ===========================
 
ComboFix.txt File

ComboFix 09-12-29.06 - skahana 30/12/2009 18:24:36.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.353.1033.18.1022.411 [GMT 0:00]
Running from: c:\users\skahana\Desktop\ComboFix.exe
AV: Norton Internet Security *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
SP: Norton Internet Security *enabled* (Updated) {CBB7EE13-8244-4DAB-8B55-D5C7AA91E59A}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-192345369-2729201545-2745846667-1000
c:\$recycle.bin\S-1-5-21-2152478756-3922319563-605102323-500
c:\$recycle.bin\S-1-5-21-2558425627-3139798494-1447403083-1001
c:\$recycle.bin\S-1-5-21-3935076561-1982378966-2965783970-500
c:\programdata\Microsoft\Windows\Start Menu\Programs\PlayMP3z
c:\programdata\sp\sp.Dll
c:\users\skahana\AppData\Local\Microsoft\Windows\Temporary Internet Files\781ff7ba-a318-5420-0549-9808ccc462ea
c:\users\skahana\AppData\Local\Microsoft\Windows\Temporary Internet Files\98eee98e-47f1-950c-2502-5e2a580fc64f
c:\windows\system32\SIntf16.dll
c:\windows\system32\tmp.reg

Infected copy of c:\windows\system32\drivers\nvstor32.sys was found and disinfected
Restored copy from - Kitty ate it :p
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_Boonty Games
-------\Service_MyWebSearchService
-------\Service_SPService


((((((((((((((((((((((((( Files Created from 2009-11-28 to 2009-12-30 )))))))))))))))))))))))))))))))
.

2009-12-30 18:38 . 2009-12-30 18:42 -------- d-----w- c:\users\skahana\AppData\Local\temp
2009-12-30 18:38 . 2009-12-30 18:38 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-12-30 18:38 . 2009-12-30 18:38 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2009-12-24 06:59 . 2009-12-24 06:59 88416 ----a-w- c:\users\Administrator\AppData\Local\GDIPFONTCACHEV1.DAT
2009-12-24 03:39 . 2009-12-24 03:39 -------- d-----w- c:\users\skahana\AppData\Roaming\Registry Mechanic
2009-12-24 03:21 . 2004-08-04 08:00 506368 ----a-w- c:\windows\system32\msxml.dll
2009-12-24 03:21 . 2009-12-24 03:21 -------- d-----w- c:\program files\Common Files\PC Tools
2009-12-24 00:47 . 2009-12-03 16:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-24 00:47 . 2009-12-03 16:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-24 00:47 . 2009-12-24 00:47 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-12-24 00:01 . 2008-11-06 02:03 -------- d-----w- C:\SDFix
2009-12-23 20:22 . 2009-12-23 20:25 -------- d-----w- c:\programdata\PCPitstop
2009-12-23 20:22 . 2009-12-24 03:24 -------- d-----w- c:\program files\PCPitstop
2009-12-12 03:01 . 2009-11-09 12:31 24064 ----a-w- c:\windows\system32\nshhttp.dll
2009-12-12 03:01 . 2009-11-09 10:36 411648 ----a-w- c:\windows\system32\drivers\http.sys
2009-12-12 03:01 . 2009-11-09 12:30 30720 ----a-w- c:\windows\system32\httpapi.dll
2009-12-11 11:42 . 2009-12-11 11:42 -------- d-----w- c:\users\Administrator\AppData\Roaming\FaxCtr
2009-12-09 23:12 . 2009-08-24 11:36 377344 ----a-w- c:\windows\system32\winhttp.dll
2009-12-09 23:08 . 2009-10-07 11:36 243712 ----a-w- c:\windows\system32\rastls.dll
2009-12-09 00:24 . 2009-12-10 08:26 -------- d-----w- c:\programdata\NOS
2009-12-08 22:57 . 2009-12-08 22:57 -------- d-----w- c:\program files\Microsoft Windows 7 Upgrade Advisor
2009-12-08 22:52 . 2009-12-08 22:56 -------- d-----w- c:\users\Administrator\AppData\Local\Google
2009-12-08 22:51 . 2009-12-08 22:51 0 ----a-w- c:\windows\nsreg.dat
2009-12-08 22:51 . 2009-12-08 22:51 -------- d-----w- c:\users\Administrator\AppData\Local\Mozilla
2009-12-08 20:46 . 2009-12-08 20:46 -------- d-----w- c:\programdata\Malwarebytes
2009-12-08 20:29 . 2009-12-08 20:29 -------- d-----w- c:\users\skahana\AppData\Roaming\WinBatch
2009-12-08 20:15 . 2009-12-08 20:15 -------- d-----w- c:\program files\Garmin GPS Plugin

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-30 18:39 . 2008-03-14 16:53 12 ----a-w- c:\windows\bthservsdp.dat
2009-12-30 18:37 . 2009-11-24 17:02 -------- d-----w- c:\programdata\SP
2009-12-30 16:21 . 2008-07-25 19:26 -------- d-----w- c:\program files\Lx_cats
2009-12-26 16:02 . 2009-10-25 12:14 -------- d-----w- c:\program files\Uniblue
2009-12-26 16:02 . 2009-10-25 12:14 -------- d-----w- c:\users\skahana\AppData\Roaming\Uniblue
2009-12-23 23:02 . 2009-12-23 23:02 691 ----a-w- c:\users\skahana\AppData\Roaming\GetValue.vbs
2009-12-23 23:02 . 2009-12-23 23:02 35 ----a-w- c:\users\skahana\AppData\Roaming\SetValue.bat
2009-12-23 23:00 . 2009-03-12 20:21 1356 ----a-w- c:\users\skahana\AppData\Local\d3d9caps.dat
2009-12-17 12:31 . 2008-01-31 19:47 5636 ----a-w- c:\users\skahana\AppData\Roaming\wklnhst.dat
2009-12-10 03:27 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-12-08 20:50 . 2007-09-14 02:06 -------- d-----w- c:\program files\Hewlett-Packard
2009-12-08 20:50 . 2008-02-26 14:11 -------- d-----w- c:\users\skahana\AppData\Roaming\Hewlett-Packard
2009-12-08 20:50 . 2007-09-14 02:58 -------- d-----w- c:\programdata\Hewlett-Packard
2009-12-08 20:28 . 2009-05-09 12:24 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-12-08 20:16 . 2009-07-20 14:05 -------- d-----w- c:\users\skahana\AppData\Roaming\GARMIN
2009-12-08 19:41 . 2008-03-20 15:43 -------- d-----w- c:\program files\Bullfrog
2009-12-05 20:30 . 2009-08-11 10:43 -------- d-----w- c:\users\skahana\AppData\Roaming\FrostWire
2009-11-21 06:40 . 2009-12-09 23:10 916480 ----a-w- c:\windows\system32\wininet.dll
2009-11-21 06:34 . 2009-12-09 23:10 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-11-21 06:34 . 2009-12-09 23:10 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-11-21 04:59 . 2009-12-09 23:10 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-11-18 03:24 . 2009-11-18 03:24 -------- d-----w- c:\program files\Windows Portable Devices
2009-11-18 03:24 . 2009-11-18 03:24 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2009-11-18 03:23 . 2009-11-18 03:23 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
2009-11-12 22:24 . 2009-10-14 20:10 -------- d-----w- c:\program files\iTunes
2009-11-12 22:22 . 2009-11-12 22:22 -------- d-----w- c:\program files\iPod
2009-11-12 22:22 . 2008-03-06 00:13 -------- d-----w- c:\program files\Common Files\Apple
2009-11-07 17:03 . 2007-09-14 02:31 -------- d-----w- c:\program files\Java
2009-11-02 20:42 . 2009-10-26 23:04 195456 ------w- c:\windows\system32\MpSigStub.exe
2009-11-01 19:21 . 2009-11-01 19:21 6257161 ----a-w- c:\programdata\SPL1EAA.tmp
2009-11-01 17:59 . 2009-11-01 17:59 -------- d-----w- c:\users\skahana\AppData\Roaming\SmartDraw
2009-10-31 20:13 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Sidebar
2009-10-31 20:13 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Journal
2009-10-31 20:13 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Collaboration
2009-10-31 20:13 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Calendar
2009-10-31 20:13 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Photo Gallery
2009-10-31 20:13 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Defender
2009-10-29 09:17 . 2009-11-26 03:02 2048 ----a-w- c:\windows\system32\tzres.dll
2009-10-11 04:17 . 2009-08-25 21:12 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-10-08 21:08 . 2009-11-18 03:01 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll
2009-10-08 21:08 . 2009-11-18 03:01 234496 ----a-w- c:\windows\system32\oleacc.dll
2009-10-08 21:07 . 2009-11-18 03:01 4096 ----a-w- c:\windows\system32\oleaccrc.dll
2007-09-14 02:50 . 2007-09-14 02:43 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"RegistryMechanic"="c:\program files\Registry Mechanic\RMTray.exe" [2009-11-25 292824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SSDMonitor"="c:\program files\Common Files\PC Tools\sMonitor\SSDMonitor.exe" [2009-11-25 104408]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Edimax Wireless Utility.lnk - c:\program files\Edimax\Common\RaUI.exe [2008-1-28 937984]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cfphv]
C: [X]
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MyWebSearch Email Plugin

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\psiyf]
C: [X]
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSHNAS
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Videohost

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-06-06 08:11 149040 ----a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CarryLaunch]
2007-09-20 11:12 75024 ----a-w- c:\users\skahana\AppData\Roaming\CoSoSys\CarryItEasy\CarryLaunch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2009-12-08 23:56 135664 ----atw- c:\users\skahana\AppData\Local\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPADVISOR]
2009-08-05 11:27 1644088 ----a-w- c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 16:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-19 07:33 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):a7,37,c3,dc,67,5a,ca,01

R0 SymEFA;Symantec Extended File Attributes;c:\windows\System32\drivers\NIS\1007020.00B\SymEFA.sys [31/08/2009 23:40 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\System32\drivers\NIS\1007020.00B\BHDrvx86.sys [31/08/2009 23:40 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\System32\drivers\NIS\1007020.00B\cchpx86.sys [31/08/2009 23:39 482432]
R1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091217.002\IDSvix86.sys [18/12/2009 21:38 343088]
R2 lxdd_device;lxdd_device;c:\windows\system32\lxddcoms.exe -service --> c:\windows\system32\lxddcoms.exe -service [?]
R2 lxddCATSCustConnectService;lxddCATSCustConnectService;c:\windows\System32\spool\drivers\w32x86\3\lxddserv.exe [25/05/2007 09:41 99248]
R2 Norton Internet Security;Norton Internet Security;c:\program files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe [31/08/2009 23:39 117640]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\Common Files\PC Tools\sMonitor\StartManSvc.exe [24/12/2009 03:21 583640]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [08/12/2009 16:41 102448]
R3 SYMNDISV;Symantec Network Filter Driver;c:\windows\System32\drivers\NIS\1007020.00B\symndisv.sys [31/08/2009 23:40 48688]
S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [30/06/2008 21:38 21504]
S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [27/10/2009 19:34 54632]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/2009 22:48 704864]
S3 netr28u;802.11n USB Wireless LAN Card Driver for Vista;c:\windows\System32\drivers\netr28u.sys [28/01/2008 16:51 328192]
S3 s115bus;Sony Ericsson Device 115 driver (WDM);c:\windows\System32\drivers\s115bus.sys [23/04/2007 12:54 83208]
S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;c:\windows\System32\drivers\s115mdfl.sys [23/04/2007 12:54 15112]
S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;c:\windows\System32\drivers\s115mdm.sys [23/04/2007 12:54 108680]
S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);c:\windows\System32\drivers\s115mgmt.sys [23/04/2007 12:54 100488]
S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;c:\windows\System32\drivers\s115obex.sys [23/04/2007 12:54 98568]
S4 sptd;sptd;c:\windows\System32\drivers\sptd.sys [06/05/2008 16:06 717296]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder

2009-12-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2558425627-3139798494-1447403083-1000Core.job
- c:\users\skahana\AppData\Local\Google\Update\GoogleUpdate.exe [2009-12-08 23:56]

2009-12-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2558425627-3139798494-1447403083-1000UA.job
- c:\users\skahana\AppData\Local\Google\Update\GoogleUpdate.exe [2009-12-08 23:56]

2009-12-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2558425627-3139798494-1447403083-500Core.job
- c:\users\Administrator\AppData\Local\Google\Update\GoogleUpdate.exe [2009-12-08 22:52]

2009-12-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2558425627-3139798494-1447403083-500UA.job
- c:\users\Administrator\AppData\Local\Google\Update\GoogleUpdate.exe [2009-12-08 22:52]

2009-12-30 c:\windows\Tasks\User_Feed_Synchronization-{5593B5E8-0C2E-48C0-98CE-2F6B6F317ED8}.job
- c:\windows\system32\msfeedssync.exe [2009-12-09 04:59]

2009-12-20 c:\windows\Tasks\User_Feed_Synchronization-{5D8AEA88-9167-40E2-AEF5-0F778D726017}.job
- c:\windows\system32\msfeedssync.exe [2009-12-09 04:59]

2009-12-30 c:\windows\Tasks\User_Feed_Synchronization-{C71841E7-818C-4485-93EC-A8902806BC9D}.job
- c:\windows\system32\msfeedssync.exe [2009-12-09 04:59]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
Trusted Zone: hp.com\pavilion.buttonredirect
Trusted Zone: hp.com\presario.buttonredirect
Trusted Zone: vodafone.ie\mim
Trusted Zone: vodafone.ie\www
DPF: {6824D897-F7E1-4E41-B84B-B1D3FA4BF1BD} - hxxp://utilities.pcpitstop.com/Exterminate2/pcpitstopAntiVirus.dll
FF - ProfilePath - c:\users\skahana\AppData\Roaming\Mozilla\Firefox\Profiles\cp2axbp7.default\
FF - prefs.js: browser.startup.homepage - google.ie
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - component: c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\components\coFFPlgn.dll
FF - component: c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\users\skahana\AppData\Local\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\users\skahana\AppData\Roaming\Mozilla\Firefox\Profiles\cp2axbp7.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
ShellIconOverlayIdentifiers-{96AFBE69-C3B0-4b00-8578-D933D2896EE2} - (no file)
MSConfigStartUp-Uniblue RegistryBooster 2009 - c:\program files\uniblue\registrybooster\StartRegistryBooster.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-30 18:40
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Norton Internet Security]
"ImagePath"="\"c:\program files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\diMaster.dll\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a4,c6,e8,c6,92,46,95,44,ad,fc,c3,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a4,c6,e8,c6,92,46,95,44,ad,fc,c3,\

[HKEY_USERS\S-1-5-21-2558425627-3139798494-1447403083-1000\Software\SecuROM\License information*]
"datasecu"=hex:29,a6,55,86,79,5d,65,60,79,50,e2,79,64,ae,08,b3,df,71,74,be,39,
2b,ea,e4,a4,b7,c6,8e,cb,a5,94,29,fa,4b,f2,3a,c4,2c,f3,43,88,e6,7c,7b,ff,0d,\
"rkeysecu"=hex:db,c0,d3,8a,03,6e,9d,f1,bf,a1,08,e0,9e,45,a3,bf

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(1752)
c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_eng.nlr
c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
c:\windows\system32\lxddcoms.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\DllHost.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe
.
**************************************************************************
.
Completion time: 2009-12-30 18:55:09 - machine was rebooted
ComboFix-quarantined-files.txt 2009-12-30 18:55

Pre-Run: 47,569,498,112 bytes free
Post-Run: 48,844,386,304 bytes free

- - End Of File - - 7F40AE2F4D34B25064CCFA7FD57D92CB
 
Hi again,

Uninstall Frostwire as it's P2P program too.


Open notepad and copy/paste the text in the quotebox below into it:

Code: 
DDS::
TB: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No File
TB: {BC4FFE41-DE9F-46FA-B455-AAD49B9F9938} - No File
File::
c:\users\skahana\appdata\roaming\GetValue.vbs
c:\users\skahana\appdata\roaming\SetValue.bat
Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cfphv]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MyWebSearch Email Plugin]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\psiyf]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSHNAS]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Videohost]
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000000


Save this as
CFScript

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.

CFScriptB-4.gif


Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.



Check here to see if your Flash is up-to-date (do it separately with each of your browsers). If not, uninstall vulnerable versions by following instructions here. Fresh version can be obtained here.


Uninstall this vulnerable Java:
Java(TM) SE Runtime Environment 6 Update 1


Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

If you use Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

If you use Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.


Please run an online scan with Kaspersky Online Scanner as instructed in the screenshot here.


Post back its report, a fresh dds.txt log and above mentioned ComboFix resultant log.
 
Hi there,

Upon running that last scan ComboFix. It detected a rootkit. and hence, my pc is running smoothly again.. all the programs are running as they should, the pc is not being intruded anymore... and startup is much more fast-paced... as this is so, is there a requirement to do what was listed in your previous post??

thanks kindly
cg123
 
Hi,

Those steps in my post hold further cleaning and securing system by updating some vulnerable apps. Please follow the instructions and post back the requested logs even if system seems to perform well :)
 
Hi again :)

Only able to logon now... Power Outage. caused by severe weather...

Just skimmed over that copy/paste for notepad... i see:
"DisableMonitoring" for my antivirus and firewall ?

why does it say that?

/...\
Cg123
 
Those are registry modifications that will set the settings to proper values.
 
Blade81 said:
Please run an online scan with Kaspersky Online Scanner as instructed in the screenshot here.
Click to expand...

I did intend to do the scan... downloaded updates and database fine, but failed before i could click scan..... numerous times... :/

Here is the new DDS

DDS (Ver_09-12-01.01) - NTFSx86
Run by skahana at 16:43:02.81 on 03/01/2010
Internet Explorer: 8.0.6001.18865 BrowserJavaVersion: 1.6.0_17
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.353.1033.18.1022.264 [GMT 0:00]

AV: Norton Internet Security *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
SP: Norton Internet Security *enabled* (Updated) {CBB7EE13-8244-4DAB-8B55-D5C7AA91E59A}
FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k bthsvcs
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Windows\system32\spool\DRIVERS\W32X86\3\lxddserv.exe
C:\Windows\system32\lxddcoms.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\System32\alg.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\system32\taskeng.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Windows\explorer.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\skahana\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\skahana\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\skahana\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\skahana\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\skahana\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\skahana\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\skahana\Documents\Downloads\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uInternet Settings,ProxyOverride = *.local
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
TB: DAEMON Tools Toolbar: {32099aac-c132-4136-9e9a-4e364a424e17} - c:\program files\daemon tools toolbar\DTToolbar.dll
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton internet security\norton internet security\engine\16.7.2.11\coIEPlg.dll
TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
dRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\edimax~1.lnk - c:\program files\edimax\common\RaUI.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\npjpi160_17.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
Trusted Zone: hp.com\pavilion.buttonredirect
Trusted Zone: hp.com\presario.buttonredirect
Trusted Zone: vodafone.ie\mim
Trusted Zone: vodafone.ie\www
DPF: {6824D897-F7E1-4E41-B84B-B1D3FA4BF1BD} - hxxp://utilities.pcpitstop.com/Exterminate2/pcpitstopAntiVirus.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} - hxxp://utilities.pcpitstop.com/Optimize3/pcpitstop2.dll
Handler: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - c:\program files\norton internet security\norton internet security\engine\16.7.2.11\CoIEPlg.dll

================= FIREFOX ===================

FF - ProfilePath - c:\users\skahana\appdata\roaming\mozilla\firefox\profiles\cp2axbp7.default\
FF - prefs.js: browser.startup.homepage - google.ie
FF - component: c:\program files\nokia\nokia pc suite 7\bkmrksync\components\BkMrkExt.dll
FF - component: c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\coffplgn\components\coFFPlgn.dll
FF - component: c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\ipsffplgn\components\IPSFFPl.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\users\skahana\appdata\local\google\update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\users\skahana\appdata\roaming\mozilla\firefox\profiles\cp2axbp7.default\extensions\{e2883e8f-472f-4fb0-9522-ac9bf37916a7}\plugins\np_gp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\nis\1007020.00b\BHDrvx86.sys [2009-8-31 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\nis\1007020.00b\cchpx86.sys [2009-8-31 482432]
R1 IDSVix86;IDSVix86;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\ipsdefs\20091217.002\IDSvix86.sys [2009-12-18 343088]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-12-8 102448]
R3 netr28u;802.11n USB Wireless LAN Card Driver for Vista;c:\windows\system32\drivers\netr28u.sys [2008-1-28 328192]
S3 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2009-10-27 54632]

=============== Created Last 30 ================

2010-01-01 14:42:56 149280 ----a-w- c:\windows\system32\REN35BF.tmp
2010-01-01 14:32:04 0 d-sh--w- C:\$RECYCLE.BIN
2009-12-30 18:10:03 98816 ----a-w- c:\windows\sed.exe
2009-12-30 18:10:03 77312 ----a-w- c:\windows\MBR.exe
2009-12-30 18:10:03 261632 ----a-w- c:\windows\PEV.exe
2009-12-30 18:10:03 161792 ----a-w- c:\windows\SWREG.exe
2009-12-24 03:39:55 0 d-----w- c:\users\skahana\appdata\roaming\Registry Mechanic
2009-12-24 02:55:01 1576 ----a-w- c:\windows\system32\.htaccess
2009-12-24 00:47:21 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-24 00:47:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-24 00:47:12 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-12-24 00:01:18 0 d-----w- C:\SDFix
2009-12-23 20:22:04 0 d-----w- c:\programdata\PCPitstop
2009-12-23 20:22:02 0 d-----w- c:\program files\PCPitstop
2009-12-12 03:01:14 24064 ----a-w- c:\windows\system32\nshhttp.dll
2009-12-12 03:01:08 411648 ----a-w- c:\windows\system32\drivers\http.sys
2009-12-12 03:01:07 30720 ----a-w- c:\windows\system32\httpapi.dll
2009-12-09 23:12:08 377344 ----a-w- c:\windows\system32\winhttp.dll
2009-12-09 23:08:31 243712 ----a-w- c:\windows\system32\rastls.dll
2009-12-09 00:24:37 0 d-----w- c:\programdata\NOS
2009-12-08 22:57:44 0 d-----w- c:\program files\Microsoft Windows 7 Upgrade Advisor
2009-12-08 20:46:52 0 d-----w- c:\programdata\Malwarebytes
2009-12-08 20:29:18 0 d-----w- c:\users\skahana\appdata\roaming\WinBatch
2009-12-08 20:15:44 0 d-----w- c:\program files\Garmin GPS Plugin

==================== Find3M ====================

2009-12-17 12:31:23 5636 ----a-w- c:\users\skahana\appdata\roaming\wklnhst.dat
2009-12-08 20:15:39 51200 ----a-w- c:\windows\inf\infpub.dat
2009-12-08 20:15:39 143360 ----a-w- c:\windows\inf\infstrng.dat
2009-12-08 20:15:39 143360 ----a-w- c:\windows\inf\infstor.dat
2009-11-21 06:40:20 916480 ----a-w- c:\windows\system32\wininet.dll
2009-11-21 06:34:39 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-11-21 06:34:39 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-11-21 04:59:58 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-11-18 03:24:48 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-11-18 03:24:39 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2009-11-18 03:23:58 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
2009-11-02 20:42:06 195456 ------w- c:\windows\system32\MpSigStub.exe
2009-10-31 19:53:54 37665 ----a-w- c:\windows\fonts\GlobalUserInterface.CompositeFont
2009-10-29 09:17:42 2048 ----a-w- c:\windows\system32\tzres.dll
2009-10-11 04:17:45 386872 ----a-w- c:\windows\system32\jucheck.exe
2009-10-11 04:17:36 55072 ----a-w- c:\windows\system32\jureg.exe
2009-10-11 04:17:27 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-10-08 21:08:01 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll
2009-10-08 21:08:01 234496 ----a-w- c:\windows\system32\oleacc.dll
2009-10-08 21:07:59 4096 ----a-w- c:\windows\system32\oleaccrc.dll
2008-12-08 03:51:22 174 --sha-w- c:\program files\desktop.ini
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
2007-09-14 02:50:13 8192 --sha-w- c:\windows\users\default\NTUSER.DAT

============= FINISH: 16:47:26.56 ===============


And Here is the CFLog

ComboFix 09-12-29.06 - skahana 01/01/2010 14:09:25.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.353.1033.18.1022.487 [GMT 0:00]
Running from: c:\users\skahana\Desktop\ComboFix.exe
Command switches used :: c:\users\skahana\Desktop\CFScript.txt
AV: Norton Internet Security *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
SP: Norton Internet Security *enabled* (Updated) {CBB7EE13-8244-4DAB-8B55-D5C7AA91E59A}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

FILE ::
"c:\users\skahana\appdata\roaming\GetValue.vbs"
"c:\users\skahana\appdata\roaming\SetValue.bat"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\skahana\appdata\roaming\GetValue.vbs
c:\users\skahana\appdata\roaming\SetValue.bat

.
((((((((((((((((((((((((( Files Created from 2009-12-01 to 2010-01-01 )))))))))))))))))))))))))))))))
.

2010-01-01 14:24 . 2010-01-01 14:24 -------- d-----w- c:\users\skahana\AppData\Local\temp
2010-01-01 14:24 . 2010-01-01 14:24 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-01-01 14:24 . 2010-01-01 14:24 -------- d-----w- c:\users\luke\AppData\Local\temp
2010-01-01 14:24 . 2010-01-01 14:24 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-01-01 14:24 . 2010-01-01 14:24 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2010-01-01 07:55 . 2009-12-09 09:00 2747440 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091231.041\CCERASER.DLL
2010-01-01 07:55 . 2009-11-01 10:42 84912 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091231.041\NAVENG.SYS
2010-01-01 07:55 . 2009-11-01 10:42 371248 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091231.041\EECTRL.SYS
2010-01-01 07:55 . 2009-11-01 10:42 259440 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091231.041\ECMSVR32.DLL
2010-01-01 07:55 . 2009-11-01 10:42 177520 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091231.041\NAVENG32.DLL
2010-01-01 07:55 . 2009-11-01 10:42 1647984 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091231.041\NAVEX32A.DLL
2010-01-01 07:55 . 2009-11-01 10:42 1323568 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091231.041\NAVEX15.SYS
2010-01-01 07:55 . 2009-11-01 10:42 102448 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20091231.041\ERASER.SYS
2009-12-30 20:09 . 2009-12-30 20:09 -------- d-----w- c:\users\skahana\AppData\Local\Microsoft Corporation
2009-12-24 06:59 . 2009-12-24 06:59 88416 ----a-w- c:\users\Administrator\AppData\Local\GDIPFONTCACHEV1.DAT
2009-12-24 03:39 . 2009-12-24 03:39 -------- d-----w- c:\users\skahana\AppData\Roaming\Registry Mechanic
2009-12-24 00:47 . 2009-12-03 16:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-24 00:47 . 2009-12-03 16:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-24 00:47 . 2009-12-24 00:47 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-12-24 00:01 . 2008-11-06 02:03 -------- d-----w- C:\SDFix
2009-12-23 20:22 . 2009-12-23 20:25 -------- d-----w- c:\programdata\PCPitstop
2009-12-23 20:22 . 2009-12-24 03:24 -------- d-----w- c:\program files\PCPitstop
2009-12-18 21:38 . 2009-10-28 22:37 329592 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091217.002\IDSXpx86.sys
2009-12-18 21:38 . 2009-10-28 22:37 811896 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091217.002\Scxpx86.dll
2009-12-18 21:38 . 2009-10-28 22:37 343088 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091217.002\IDSvix86.sys
2009-12-18 21:38 . 2009-10-28 22:37 488312 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091217.002\IDSxpx86.dll
2009-12-18 21:38 . 2009-10-28 22:37 466992 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091217.002\IDSviA64.sys
2009-12-15 01:53 . 2009-10-28 22:37 343088 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091211.001\IDSvix86.sys
2009-12-15 01:53 . 2009-10-28 22:37 329592 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091211.001\IDSXpx86.sys
2009-12-15 01:53 . 2009-10-28 22:37 811896 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091211.001\Scxpx86.dll
2009-12-15 01:53 . 2009-10-28 22:37 488312 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091211.001\IDSxpx86.dll
2009-12-15 01:53 . 2009-10-28 22:37 466992 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091211.001\IDSviA64.sys
2009-12-12 03:01 . 2009-11-09 12:31 24064 ----a-w- c:\windows\system32\nshhttp.dll
2009-12-12 03:01 . 2009-11-09 10:36 411648 ----a-w- c:\windows\system32\drivers\http.sys
2009-12-12 03:01 . 2009-11-09 12:30 30720 ----a-w- c:\windows\system32\httpapi.dll
2009-12-11 11:42 . 2009-12-11 11:42 -------- d-----w- c:\users\Administrator\AppData\Roaming\FaxCtr
2009-12-09 23:12 . 2009-08-24 11:36 377344 ----a-w- c:\windows\system32\winhttp.dll
2009-12-09 23:08 . 2009-10-07 11:36 243712 ----a-w- c:\windows\system32\rastls.dll
2009-12-09 00:24 . 2009-12-10 08:26 -------- d-----w- c:\programdata\NOS
2009-12-09 00:20 . 2009-12-01 19:43 34496 ----a-w- c:\users\skahana\AppData\Roaming\Mozilla\Firefox\Profiles\cp2axbp7.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
2009-12-09 00:20 . 2009-12-01 19:43 25936 ----a-w- c:\users\skahana\AppData\Roaming\Mozilla\Firefox\Profiles\cp2axbp7.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg.exe
2009-12-08 22:57 . 2009-12-08 22:57 -------- d-----w- c:\program files\Microsoft Windows 7 Upgrade Advisor
2009-12-08 22:52 . 2009-12-08 22:56 -------- d-----w- c:\users\Administrator\AppData\Local\Google
2009-12-08 22:51 . 2009-12-08 22:51 0 ----a-w- c:\windows\nsreg.dat
2009-12-08 22:51 . 2009-12-08 22:51 -------- d-----w- c:\users\Administrator\AppData\Local\Mozilla
2009-12-08 20:46 . 2009-12-08 20:46 -------- d-----w- c:\programdata\Malwarebytes
2009-12-08 20:29 . 2009-12-08 20:29 -------- d-----w- c:\users\skahana\AppData\Roaming\WinBatch
2009-12-08 20:28 . 2009-12-08 20:28 38784 ----a-w- c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-12-08 20:15 . 2009-12-08 20:15 -------- d-----w- c:\program files\Garmin GPS Plugin

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-30 18:39 . 2008-03-14 16:53 12 ----a-w- c:\windows\bthservsdp.dat
2009-12-30 18:37 . 2009-11-24 17:02 -------- d-----w- c:\programdata\SP
2009-12-30 16:21 . 2008-07-25 19:26 -------- d-----w- c:\program files\Lx_cats
2009-12-26 16:02 . 2009-10-25 12:14 -------- d-----w- c:\program files\Uniblue
2009-12-26 16:02 . 2009-10-25 12:14 -------- d-----w- c:\users\skahana\AppData\Roaming\Uniblue
2009-12-23 23:00 . 2009-03-12 20:21 1356 ----a-w- c:\users\skahana\AppData\Local\d3d9caps.dat
2009-12-17 12:31 . 2008-01-31 19:47 5636 ----a-w- c:\users\skahana\AppData\Roaming\wklnhst.dat
2009-12-10 03:27 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-12-08 20:50 . 2007-09-14 02:06 -------- d-----w- c:\program files\Hewlett-Packard
2009-12-08 20:50 . 2008-02-26 14:11 -------- d-----w- c:\users\skahana\AppData\Roaming\Hewlett-Packard
2009-12-08 20:50 . 2007-09-14 02:58 -------- d-----w- c:\programdata\Hewlett-Packard
2009-12-08 20:28 . 2009-05-09 12:24 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-12-08 20:28 . 2009-12-08 22:47 38784 ----a-w- c:\users\Administrator\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-12-08 20:28 . 2008-09-13 23:19 38784 ----a-w- c:\users\skahana\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-12-08 20:16 . 2009-07-20 14:05 -------- d-----w- c:\users\skahana\AppData\Roaming\GARMIN
2009-12-08 19:41 . 2008-03-20 15:43 -------- d-----w- c:\program files\Bullfrog
2009-11-21 06:40 . 2009-12-09 23:10 916480 ----a-w- c:\windows\system32\wininet.dll
2009-11-21 06:34 . 2009-12-09 23:10 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-11-21 06:34 . 2009-12-09 23:10 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-11-21 04:59 . 2009-12-09 23:10 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-11-18 03:24 . 2009-11-18 03:24 -------- d-----w- c:\program files\Windows Portable Devices
2009-11-18 03:24 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-11-18 03:24 . 2009-11-18 03:24 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2009-11-18 03:23 . 2009-11-18 03:23 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
2009-11-12 22:24 . 2009-10-14 20:10 -------- d-----w- c:\program files\iTunes
2009-11-12 22:22 . 2009-11-12 22:22 -------- d-----w- c:\program files\iPod
2009-11-12 22:22 . 2008-03-06 00:13 -------- d-----w- c:\program files\Common Files\Apple
2009-11-12 22:04 . 2009-11-12 22:04 79144 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-11-07 17:03 . 2007-09-14 02:31 -------- d-----w- c:\program files\Java
2009-11-02 20:42 . 2009-10-26 23:04 195456 ------w- c:\windows\system32\MpSigStub.exe
2009-11-01 19:21 . 2009-11-01 19:21 6257161 ----a-w- c:\programdata\SPL1EAA.tmp
2009-10-29 09:17 . 2009-11-26 03:02 2048 ----a-w- c:\windows\system32\tzres.dll
2009-10-11 04:17 . 2009-08-25 21:12 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-10-08 21:08 . 2009-11-18 03:01 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll
2009-10-08 21:08 . 2009-11-18 03:01 234496 ----a-w- c:\windows\system32\oleacc.dll
2009-10-08 21:07 . 2009-11-18 03:01 4096 ----a-w- c:\windows\system32\oleaccrc.dll
2009-10-04 21:00 . 2009-10-04 21:00 95232 ----a-w- c:\programdata\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\pcswpcsi.exe
2009-10-04 21:00 . 2009-10-04 21:00 8192 ----a-w- c:\programdata\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstCCD.exe
2009-10-04 21:00 . 2009-10-04 21:00 61440 ----a-w- c:\programdata\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2009-10-04 21:00 . 2009-10-04 21:00 10240 ----a-w- c:\programdata\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstPCS.exe
2009-10-04 20:59 . 2009-10-04 21:01 33773208 ----a-w- c:\programdata\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Nokia_PC_Suite_7_1_30_9_wu_eng.exe
2007-09-14 02:50 . 2007-09-14 02:43 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Edimax Wireless Utility.lnk - c:\program files\Edimax\Common\RaUI.exe [2008-1-28 937984]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-06-06 08:11 149040 ----a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CarryLaunch]
2007-09-20 11:12 75024 ----a-w- c:\users\skahana\AppData\Roaming\CoSoSys\CarryItEasy\CarryLaunch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2008-07-24 15:02 490952 ----a-w- c:\program files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2009-12-08 23:56 135664 ----atw- c:\users\skahana\AppData\Local\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPADVISOR]
2009-08-05 11:27 1644088 ----a-w- c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 16:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-19 07:33 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):a7,37,c3,dc,67,5a,ca,01

R0 SymEFA;Symantec Extended File Attributes;c:\windows\System32\drivers\NIS\1007020.00B\SymEFA.sys [31/08/2009 23:40 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\System32\drivers\NIS\1007020.00B\BHDrvx86.sys [31/08/2009 23:40 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\System32\drivers\NIS\1007020.00B\cchpx86.sys [31/08/2009 23:39 482432]
R1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091217.002\IDSvix86.sys [18/12/2009 21:38 343088]
R2 lxdd_device;lxdd_device;c:\windows\system32\lxddcoms.exe -service --> c:\windows\system32\lxddcoms.exe -service [?]
R2 lxddCATSCustConnectService;lxddCATSCustConnectService;c:\windows\System32\spool\drivers\w32x86\3\lxddserv.exe [25/05/2007 09:41 99248]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [08/12/2009 16:41 102448]
R3 netr28u;802.11n USB Wireless LAN Card Driver for Vista;c:\windows\System32\drivers\netr28u.sys [28/01/2008 16:51 328192]
R3 SYMNDISV;Symantec Network Filter Driver;c:\windows\System32\drivers\NIS\1007020.00B\symndisv.sys [31/08/2009 23:40 48688]
S2 Norton Internet Security;Norton Internet Security;c:\program files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe [31/08/2009 23:39 117640]
S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [30/06/2008 21:38 21504]
S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [27/10/2009 19:34 54632]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/2009 22:48 704864]
S3 s115bus;Sony Ericsson Device 115 driver (WDM);c:\windows\System32\drivers\s115bus.sys [23/04/2007 12:54 83208]
S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;c:\windows\System32\drivers\s115mdfl.sys [23/04/2007 12:54 15112]
S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;c:\windows\System32\drivers\s115mdm.sys [23/04/2007 12:54 108680]
S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);c:\windows\System32\drivers\s115mgmt.sys [23/04/2007 12:54 100488]
S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;c:\windows\System32\drivers\s115obex.sys [23/04/2007 12:54 98568]
S4 sptd;sptd;c:\windows\System32\drivers\sptd.sys [06/05/2008 16:06 717296]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder

2010-01-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2558425627-3139798494-1447403083-1000Core.job
- c:\users\skahana\AppData\Local\Google\Update\GoogleUpdate.exe [2009-12-08 23:56]

2010-01-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2558425627-3139798494-1447403083-1000UA.job
- c:\users\skahana\AppData\Local\Google\Update\GoogleUpdate.exe [2009-12-08 23:56]

2009-12-31 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2558425627-3139798494-1447403083-500Core.job
- c:\users\Administrator\AppData\Local\Google\Update\GoogleUpdate.exe [2009-12-08 22:52]

2010-01-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2558425627-3139798494-1447403083-500UA.job
- c:\users\Administrator\AppData\Local\Google\Update\GoogleUpdate.exe [2009-12-08 22:52]

2010-01-01 c:\windows\Tasks\User_Feed_Synchronization-{5593B5E8-0C2E-48C0-98CE-2F6B6F317ED8}.job
- c:\windows\system32\msfeedssync.exe [2009-12-09 04:59]

2009-12-20 c:\windows\Tasks\User_Feed_Synchronization-{5D8AEA88-9167-40E2-AEF5-0F778D726017}.job
- c:\windows\system32\msfeedssync.exe [2009-12-09 04:59]

2010-01-01 c:\windows\Tasks\User_Feed_Synchronization-{C71841E7-818C-4485-93EC-A8902806BC9D}.job
- c:\windows\system32\msfeedssync.exe [2009-12-09 04:59]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
Trusted Zone: hp.com\pavilion.buttonredirect
Trusted Zone: hp.com\presario.buttonredirect
Trusted Zone: vodafone.ie\mim
Trusted Zone: vodafone.ie\www
DPF: {6824D897-F7E1-4E41-B84B-B1D3FA4BF1BD} - hxxp://utilities.pcpitstop.com/Exterminate2/pcpitstopAntiVirus.dll
FF - ProfilePath - c:\users\skahana\AppData\Roaming\Mozilla\Firefox\Profiles\cp2axbp7.default\
FF - prefs.js: browser.startup.homepage - google.ie
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - component: c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\components\coFFPlgn.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\users\skahana\AppData\Local\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\users\skahana\AppData\Roaming\Mozilla\Firefox\Profiles\cp2axbp7.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-01 14:24
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Norton Internet Security]
"ImagePath"="\"c:\program files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\diMaster.dll\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a4,c6,e8,c6,92,46,95,44,ad,fc,c3,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a4,c6,e8,c6,92,46,95,44,ad,fc,c3,\

[HKEY_USERS\S-1-5-21-2558425627-3139798494-1447403083-1000\Software\SecuROM\License information*]
"datasecu"=hex:29,a6,55,86,79,5d,65,60,79,50,e2,79,64,ae,08,b3,df,71,74,be,39,
2b,ea,e4,a4,b7,c6,8e,cb,a5,94,29,fa,4b,f2,3a,c4,2c,f3,43,88,e6,7c,7b,ff,0d,\
"rkeysecu"=hex:db,c0,d3,8a,03,6e,9d,f1,bf,a1,08,e0,9e,45,a3,bf

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2010-01-01 14:31:50
ComboFix-quarantined-files.txt 2010-01-01 14:31
ComboFix2.txt 2009-12-30 18:55

Pre-Run: 46,769,926,144 bytes free
Post-Run: 46,549,553,152 bytes free

- - End Of File - - 98608CFB06F704C6B4C8B04ED4A7DE35
 
Hi,

How did Kaspersky scan fail? Did you get any error message?
 
it sowloaded updates, and database.... and then it brought up an error.. cant remember exactly what, but something about internet connection... my connection was a steady and continuous one.. so I dont know...however, Ill rerun it either this evening or tomorrow morning,and if it fails, I'll do a _printscreen_ of the screen and post it up here :)

Thanks
 
You must log in or register to reply here.
Back
Top